Flutter Guides Timestamps and ltv

Timestamps and Long-Term Validation

Starting with 3.2.0, ComPDF Flutter SDK supports signature timestamps and long-term validation (LTV) material management. A timestamp authority (TSA) issues signature timestamps. LTV material includes certificate chains and revocation information such as OCSP responses and CRLs.

import 'package:compdfkit_flutter/compdfkit.dart';

Add a Signature Timestamp

Set timestampServerUrl in CPDFDigitalSignatureConfig, then follow Create Digital Signatures. Replace the example URL with your application's TSA endpoint.

final config = CPDFDigitalSignatureConfig(
  certificatePath: certificatePath,
  password: certificatePassword,
  timestampServerUrl: 'https://tsa.example.com/timestamp',
);
final success = await document.writeSignature(
  signatureWidget,
  '/path/to/signed_timestamp.pdf',
  config,
);

Signing requires network access. If the TSA is unreachable or rejects the request, the API does not fall back to signing without a timestamp. Prefer HTTPS. An iOS host using an HTTP TSA must configure the corresponding network access policy.

Use timestampSource, embeddedTimestampValid, and timestampTrusted from verifyDigitalSignature() to read the source, embedded timestamp validity, and authority trust separately. A nullable result must not be treated as successful validation.

Distinguish Time Sources

CPDFSignatureTimestampSource identifies the source of the signature's time information:

Value	Description
none	No signing time information
localClock	Time from the signer's local clock
embedded	An embedded RFC 3161 timestamp in the signature
document	The signature itself is a document timestamp

A local clock record is not a TSA timestamp. When the source is embedded, still check embeddedTimestampValid and timestampTrusted separately for timestamp validity and authority trust.

Check LTV Material

final readiness = await document.getLtvReadiness();
print(readiness.ltvReady);
print(readiness.missingMaterials);

This operation checks certificate and revocation material in the document's DSS/VRI dictionaries without network access. success indicates whether the assessment completed; ltvReady indicates material readiness. This alone does not establish certificate trust or prove that every signature meets PAdES-LT.

Add LTV Material

Open a saved signed PDF, provide a PEM file containing trust anchors, and choose an output path different from the source.

final result = await document.addSignatureLtv(
  '/path/to/signed_ltv.pdf',
  const CPDFSignatureLtvOptions(
    trustedCertificatePath: '/path/to/trusted-root.pem',
  ),
);
if (result.success) {
  await document.open(result.finalPath);
} else {
  for (final issue in result.errors) {
    print('${issue.code}: ${issue.message}');
  }
}

The SDK reads signatures from the saved file, validates the certificate chain, and collects OCSP/CRL material over the network. Use ocspUrls and crlUrls to specify responders. The currently opened document is not automatically replaced or reloaded.

Append a Document Timestamp

After adding LTV material, you can also generate a document-timestamped copy:

final result = await document.addSignatureLtv(
  '/path/to/signed_ltv.pdf',
  const CPDFSignatureLtvOptions(
    trustedCertificatePath: '/path/to/trusted-root.pem',
    appendDocumentTimestamp: true,
    timestampServerUrl: 'https://tsa.example.com/timestamp',
    timestampOutputPath: '/path/to/signed_lta.pdf',
  ),
);
if (result.success) {
  await document.open(result.finalPath);
}

Use different paths for the source, LTV output, and timestamp output. ltvPath identifies the file containing validation material, and ltaPath identifies the document-timestamped file. finalPath prefers the latter.

Check success, errors, and warnings. Failures such as an untrusted chain or unreachable responder are returned in the result. Invalid arguments or an unusable document may also throw exceptions. Output-file existence alone does not indicate success.